The New Sidecar Method for Injecting Vault Secrets Into Kubernetes

Transcript

Hi. I'm Dan McTeer, I'm a Technology Specialist for HashiCorp. Today, I wanted to talk to you about a new integration we've built that allows you to use Vault as a sidecar inside of Kubernetes.

The way the new sidecar feature works is inside of your spec file you add an annotation that basically connects you to the Vault sidecar to give you access to your secrets. You do this by associating it with your app inside of those annotations. Then you define where those secrets are going to be placed on the file system.

Once the Pod is initialized, your application containers can then access the secrets via that file system—either via a net container or an ongoing sidecar container where the secrets get refreshed automatically every so often.

The main benefit here is that you don't necessarily need to make your applications Vault-aware. They're essentially pulling the secrets from a place locally and don't need to be concerned about how to deal with the Vault API.

For more information on this feature, please visit our blog or view the demonstration after this video.